Skip to content

Commit 2171064

Browse files
ldematteelasticsearchmachine
ldematte
and
elasticsearchmachine
authored
[8.x] [Entitlements] Add checks for native libraries restricted methods (#120775) (#121017)
* [Entitlements] Add checks for native libraries restricted methods (#120775) * Introducing main21 (does not compile with main23 on the main lib) * Move foreign API to Java22; fix EntitlementInitialization to work across multiple versions * [CI] Auto commit changes from spotless --------- Co-authored-by: elasticsearchmachine <[email protected]>
1 parent 98c65ff commit 2171064

File tree

17 files changed

+513
-21
lines changed

17 files changed

+513
-21
lines changed

‎build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/MrjarPlugin.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,7 @@ private void addJar(Project project, SourceSet sourceSet, int javaVersion) {
154154
project.getConfigurations().register("java" + javaVersion);
155155
TaskProvider<Jar> jarTask = project.getTasks().register("java" + javaVersion + "Jar", Jar.class, task -> {
156156
task.from(sourceSet.getOutput());
157+
task.getArchiveClassifier().set("java" + javaVersion);
157158
});
158159
project.getArtifacts().add("java" + javaVersion, jarTask);
159160
}

‎libs/entitlement/bridge/build.gradle‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,12 @@ tasks.named('jar').configure {
1717
if (sourceSets.findByName("main23")) {
1818
from sourceSets.main23.output
1919
}
20+
if (sourceSets.findByName("main21")) {
21+
from sourceSets.main21.output
22+
}
23+
if (sourceSets.findByName("main22")) {
24+
from sourceSets.main22.output
25+
}
2026
}
2127

2228
tasks.withType(CheckForbiddenApisTask).configureEach {

‎libs/entitlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -411,11 +411,14 @@ public interface EntitlementChecker {
411411
//
412412
// Load native libraries
413413
//
414+
// Using the list of restricted methods from https://download.java.net/java/early_access/jdk24/docs/api/restricted-list.html
414415
void check$java_lang_Runtime$load(Class<?> callerClass, Runtime that, String filename);
415416

416417
void check$java_lang_Runtime$loadLibrary(Class<?> callerClass, Runtime that, String libname);
417418

418419
void check$java_lang_System$$load(Class<?> callerClass, String filename);
419420

420421
void check$java_lang_System$$loadLibrary(Class<?> callerClass, String libname);
422+
423+
void check$java_lang_ModuleLayer$Controller$enableNativeAccess(Class<?> callerClass, ModuleLayer.Controller that, Module target);
421424
}

‎libs/entitlement/bridge/src/main21/java/org/elasticsearch/entitlement/bridge/Java21EntitlementChecker.java‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the "Elastic License
4+
* 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
5+
* Public License v 1"; you may not use this file except in compliance with, at
6+
* your election, the "Elastic License 2.0", the "GNU Affero General Public
7+
* License v3.0 only", or the "Server Side Public License, v 1".
8+
*/
9+
10+
package org.elasticsearch.entitlement.bridge;
11+
12+
public interface Java21EntitlementChecker extends EntitlementChecker {}

‎libs/entitlement/bridge/src/main21/java/org/elasticsearch/entitlement/bridge/Java21EntitlementCheckerHandle.java‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the "Elastic License
4+
* 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
5+
* Public License v 1"; you may not use this file except in compliance with, at
6+
* your election, the "Elastic License 2.0", the "GNU Affero General Public
7+
* License v3.0 only", or the "Server Side Public License, v 1".
8+
*/
9+
10+
package org.elasticsearch.entitlement.bridge;
11+
12+
/**
13+
* Java21 variant of {@link EntitlementChecker} handle holder.
14+
*/
15+
public class Java21EntitlementCheckerHandle {
16+
17+
public static Java21EntitlementChecker instance() {
18+
return Holder.instance;
19+
}
20+
21+
private static class Holder {
22+
private static final Java21EntitlementChecker instance = HandleLoader.load(Java21EntitlementChecker.class);
23+
}
24+
25+
// no construction
26+
private Java21EntitlementCheckerHandle() {}
27+
}

‎libs/entitlement/bridge/src/main22/java/org/elasticsearch/entitlement/bridge/Java22EntitlementChecker.java‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the "Elastic License
4+
* 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
5+
* Public License v 1"; you may not use this file except in compliance with, at
6+
* your election, the "Elastic License 2.0", the "GNU Affero General Public
7+
* License v3.0 only", or the "Server Side Public License, v 1".
8+
*/
9+
10+
package org.elasticsearch.entitlement.bridge;
11+
12+
import java.lang.foreign.AddressLayout;
13+
import java.lang.foreign.Arena;
14+
import java.lang.foreign.FunctionDescriptor;
15+
import java.lang.foreign.Linker;
16+
import java.lang.foreign.MemoryLayout;
17+
import java.lang.foreign.MemorySegment;
18+
import java.lang.invoke.MethodHandle;
19+
import java.nio.file.Path;
20+
import java.util.function.Consumer;
21+
22+
public interface Java22EntitlementChecker extends Java21EntitlementChecker {
23+
// Sealed implementation of java.lang.foreign.AddressLayout
24+
void check$jdk_internal_foreign_layout_ValueLayouts$OfAddressImpl$withTargetLayout(
25+
Class<?> callerClass,
26+
AddressLayout that,
27+
MemoryLayout memoryLayout
28+
);
29+
30+
// Sealed implementation of java.lang.foreign.Linker
31+
void check$jdk_internal_foreign_abi_AbstractLinker$downcallHandle(
32+
Class<?> callerClass,
33+
Linker that,
34+
FunctionDescriptor function,
35+
Linker.Option... options
36+
);
37+
38+
void check$jdk_internal_foreign_abi_AbstractLinker$downcallHandle(
39+
Class<?> callerClass,
40+
Linker that,
41+
MemorySegment address,
42+
FunctionDescriptor function,
43+
Linker.Option... options
44+
);
45+
46+
void check$jdk_internal_foreign_abi_AbstractLinker$upcallStub(
47+
Class<?> callerClass,
48+
Linker that,
49+
MethodHandle target,
50+
FunctionDescriptor function,
51+
Arena arena,
52+
Linker.Option... options
53+
);
54+
55+
// Sealed implementation for java.lang.foreign.MemorySegment.reinterpret(long)
56+
void check$jdk_internal_foreign_AbstractMemorySegmentImpl$reinterpret(Class<?> callerClass, MemorySegment that, long newSize);
57+
58+
void check$jdk_internal_foreign_AbstractMemorySegmentImpl$reinterpret(
59+
Class<?> callerClass,
60+
MemorySegment that,
61+
long newSize,
62+
Arena arena,
63+
Consumer<MemorySegment> cleanup
64+
);
65+
66+
void check$jdk_internal_foreign_AbstractMemorySegmentImpl$reinterpret(
67+
Class<?> callerClass,
68+
MemorySegment that,
69+
Arena arena,
70+
Consumer<MemorySegment> cleanup
71+
);
72+
73+
void check$java_lang_foreign_SymbolLookup$$libraryLookup(Class<?> callerClass, String name, Arena arena);
74+
75+
void check$java_lang_foreign_SymbolLookup$$libraryLookup(Class<?> callerClass, Path path, Arena arena);
76+
}

‎libs/entitlement/bridge/src/main22/java/org/elasticsearch/entitlement/bridge/Java22EntitlementCheckerHandle.java‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the "Elastic License
4+
* 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
5+
* Public License v 1"; you may not use this file except in compliance with, at
6+
* your election, the "Elastic License 2.0", the "GNU Affero General Public
7+
* License v3.0 only", or the "Server Side Public License, v 1".
8+
*/
9+
10+
package org.elasticsearch.entitlement.bridge;
11+
12+
/**
13+
* Java22 variant of {@link EntitlementChecker} handle holder.
14+
*/
15+
public class Java22EntitlementCheckerHandle {
16+
17+
public static Java22EntitlementChecker instance() {
18+
return Holder.instance;
19+
}
20+
21+
private static class Holder {
22+
private static final Java22EntitlementChecker instance = HandleLoader.load(Java22EntitlementChecker.class);
23+
}
24+
25+
// no construction
26+
private Java22EntitlementCheckerHandle() {}
27+
}

‎libs/entitlement/bridge/src/main23/java/org/elasticsearch/entitlement/bridge/Java23EntitlementChecker.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,4 @@
99

1010
package org.elasticsearch.entitlement.bridge;
1111

12-
public interface Java23EntitlementChecker extends EntitlementChecker {}
12+
public interface Java23EntitlementChecker extends Java22EntitlementChecker {}

‎libs/entitlement/build.gradle‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,12 @@ dependencies {
2828
}
2929

3030
// guarding for intellij
31+
if (sourceSets.findByName("main21")) {
32+
main21CompileOnly project(path: ':libs:entitlement:bridge', configuration: 'java21')
33+
}
34+
if (sourceSets.findByName("main22")) {
35+
main22CompileOnly project(path: ':libs:entitlement:bridge', configuration: 'java22')
36+
}
3137
if (sourceSets.findByName("main23")) {
3238
main23CompileOnly project(path: ':libs:entitlement:bridge', configuration: 'java23')
3339
}

‎libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/RestEntitlementsCheckAction.java‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -199,7 +199,21 @@ static CheckAction alwaysDenied(CheckedRunnable<Exception> action) {
199199
entry("runtime_load", forPlugins(LoadNativeLibrariesCheckActions::runtimeLoad)),
200200
entry("runtime_load_library", forPlugins(LoadNativeLibrariesCheckActions::runtimeLoadLibrary)),
201201
entry("system_load", forPlugins(LoadNativeLibrariesCheckActions::systemLoad)),
202-
entry("system_load_library", forPlugins(LoadNativeLibrariesCheckActions::systemLoadLibrary))
202+
entry("system_load_library", forPlugins(LoadNativeLibrariesCheckActions::systemLoadLibrary)),
203+
204+
entry("enable_native_access", new CheckAction(VersionSpecificNativeChecks::enableNativeAccess, false, 22)),
205+
entry("address_target_layout", new CheckAction(VersionSpecificNativeChecks::addressLayoutWithTargetLayout, false, 22)),
206+
entry("donwncall_handle", new CheckAction(VersionSpecificNativeChecks::linkerDowncallHandle, false, 22)),
207+
entry("donwncall_handle_with_address", new CheckAction(VersionSpecificNativeChecks::linkerDowncallHandleWithAddress, false, 22)),
208+
entry("upcall_stub", new CheckAction(VersionSpecificNativeChecks::linkerUpcallStub, false, 22)),
209+
entry("reinterpret", new CheckAction(VersionSpecificNativeChecks::memorySegmentReinterpret, false, 22)),
210+
entry("reinterpret_cleanup", new CheckAction(VersionSpecificNativeChecks::memorySegmentReinterpretWithCleanup, false, 22)),
211+
entry(
212+
"reinterpret_size_cleanup",
213+
new CheckAction(VersionSpecificNativeChecks::memorySegmentReinterpretWithSizeAndCleanup, false, 22)
214+
),
215+
entry("symbol_lookup_name", new CheckAction(VersionSpecificNativeChecks::symbolLookupWithName, false, 22)),
216+
entry("symbol_lookup_path", new CheckAction(VersionSpecificNativeChecks::symbolLookupWithPath, false, 22))
203217
)
204218
.filter(entry -> entry.getValue().fromJavaVersion() == null || Runtime.version().feature() >= entry.getValue().fromJavaVersion())
205219
.collect(Collectors.toUnmodifiableMap(Map.Entry::getKey, Map.Entry::getValue));

0 commit comments

Comments
 (0)